Out-of-the-box Behavior in ServiceNow

Data Synced Between SCOM and ServiceNow

From SCOM to ServiceNow

Alert Attributes

From the Alert itself we sync:

  • Alert ID

  • Name

  • Description

  • Resolution State (both the name of each state and the underlying ID of the state)

  • Priority

  • Severity

  • Owner

  • Repeat Count

  • Whether the Alert is from a monitor or not

  • Alert Last Modified date/time

  • Site Name

  • Context

  • Category

  • Time raised (date/time)

  • Time Resolved (date/time)

  • Alert Custom Fields 1-10

Monitored Object Attributes

From the specific object that spawned the alert we sync:

  • Monitored object display name

  • Monitored object full name

  • Monitored object path

  • Monitored object name

  • Principal name

  • NetBIOS Computer Name

  • Monitored object ID

  • Whether the Monitored object is in maintenance mode or not

  • Monitoring object parent Ids

  • Monitoring object parent Display Names

Monitoring Configuration

From the workflow that generated the alert we sync:

  • Management Pack Display Name

  • Workflow Display Name

  • Management Pack Name

  • Workflow Name

  • Management Group

From ServiceNow to SCOM (Inbound Notifications)

When using 'Inbound Notifications' by default we sync the following from ServiceNow to SCOM:

  • Incident/Task Number → Ticket ID

  • Assignee → Owner

  • Assignment Group → Custom Field 1

  • Business Service → Custom Field 2

  • Configuration Item → Custom Field 3

  • Incident/Task State → Custom Field 4

  • Incident/Task Sys ID → Custom Field 5

This behavior can be overridden per Creation Rule using 'Advanced Alert Updates'

Ensure that nothing is stored in the selected fields in SCOM as existing data will be overwritten

From ServiceNow to SCOM (Inbound Maintenance)

  • Configuration Item Fully Qualified Domain Name

  • Start Date Time

  • End Date Time

  • Planned Boolean

  • Canceled Boolean

  • Comment

Additional Items

Whilst not transferred between SCOM and ServiceNow your records in ServiceNow will contain the following additional items:

Incident/Task

These fields link any Incident/Task and the Creation Rule that created them to your Alert Record. If there are any recent changes that could be synced back to SCOM this is also marked here.

  • Record ID

  • Creation Rule

  • Updates for SCOM?

Alert

These fields come with the Alert record in ServiceNow itself and are not to be confused with Time Raised/Last Modified in SCOM.

  • Record 'Created' date/time

  • Record 'Updated' date/time

Maintenance

These fields either come with records in ServiceNow or are included to aid with searches and further integrations.

  • Record 'Created' date/time

  • Record 'Updated' date/time

  • Related Task

  • Requested By

Search